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We claim: 



1. 



juterized method for creating an ins- 




trumented executable file, the method 



comprising: f^^rralr^cutable file to a user-supplied function; and 

redirecting an original function in amsw^u 

retaining access information of the original functic 




2. The compi 

wherein the user-supplied function is 
retained access information of the original function. 



method for creating an instrumented executable file as in claim 1 , 

invoke the original function using the 





3 TTTe-wmputerized method for creating an 
wherein the Z^^^^^ 



instrumented executable file as in claim 1, 



4 - The—crised method for creating an instrumented executable file as in claim 1, 
wherein the^jHed function is not exported during compilation. 

5 The computerized method^eating an ins— d executable file as in claim 1, 



20 6 The computerized method for creating an ins— executable file as m claim 1, 



file. 



/ 
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^* 7. The computerized melEcd^^ executable file as in claim 1, 

wherein the redirecting further comprises modifyingtRe^exesutable file. 



£/V Jg\ Tnb^omputerized method for creating an instrumented executable file as in claim 7, 
5/ wherein modifyhigthe executable file further comprises determining whether the original 
function implements the^thiscall calling convention, and when the determination is positive, 
adding instructions to the exfc^table file to perform: 

pushing the register that hcfols the 'this' pointer onto the stack from the invoked 
original function site wherKta determining indicates that the function 
implements a thiscall calling coiweqtion; and 



10 



25 



swapping the return value of the invoking originaNjinction on the stack and the 

register that holds the 'this' pointer value on the^stack when the determining 
indicates that the function implements a thiscall callingxonvention. 




9. l'he computenz^chmediQdjbr creating an instrumented executable file as in claim 7, 
wherein modifying the executable file further^Cotugrises enabling the user-supplied function 
to invoke the function in the executable file. 



0. The^omputerized method for creating an instrumented executable file as in claim 9 ? 
wherein enabling tRS^asgr-supplied function to invoke the original function in the executable 
file further comprises: 

adding a jump in the user-supplied fun5tie43jo a function that retrieves the address of 
the original function; and 

adding a jump in the user-supplied-function that invokes the ortgijial function using 
the address of the original function. 

30 
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1 1 . The computerized method for creating an instrumented executable file as in claim 1, 
further comprising enabling the user-supplied function to alter behavior. 

12. The computerized method for creating an instrumented executable file as in claim 11, 
wherein enabling theSiser-supplied function to alter behavior is performed in response to data. 

13. The computerized method for creating an instrumented executable file as in claim 12, 
wherein the data is retrieved frohj an initialization file. 



14. The computerized method for creating an instrumented executable file as in claim 1 , 
wherein the retaining further comprises: \ 

saving the address of an original function in\ threaded local storage variable; and 

creating an entry in a function lookup table associating the address of the original 

function with the name of the original function, wherein the function lookup 
table is in the instrumented executable file. \ 

15. A compuferized4Hgtiiod for executing an instrumented executable file, the 
instrumented executable file havingarforiginal function redirected to a user-supplied 
function, and the user-supplied function having a jurilp^Qjhe original function, the method 
comprising: 

saving the address of the original function in a threaded local storage variably and 
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16. The computerized method for executing an instrumented executable file as in claim 
15 5 further comprising creating a master lookup table at initialization wherein the master 
lookup table associates the base address of the instrumented executable file to the address of a 
function lookupi^able in the instrumented executable file. 

17. The computerized method for executing an instrumented executable file as in claim 
15: \ 

wherein original function is in a dynamic link library; and 

wherein the saving ancl the invoking is performed by a stub function of the original 
function, the stuMunction being located in the instrumented executable file. 

18. The computerized method forYxecuting an instrumented executable file as in claim 
15: \ 

wherein original function is embedded in the instrumented executable file; and 

wherein the saving and the invoking isVerformed by the original function. 

19. The computerized method for executing an instrumented executable file as in claim 
15, further comprising invoking the original function fr^m within the user-supplied function 
using the threaded local storage variable. \ 

20. The computerized method for executing an instrumented executable file as in claim 
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I9 5 >^ierein invoking the original function further comprises: 

pusiiihg4he register that holds the 'this' pointer onto the stack from the invoked 
originaTltHiQtion site when the determining indicates that the function 
implements a thisfcall^calling convention; and 

swapping the return value of the inwkiQg original function on the stack and the 

register that holds the 'this' pointer vahs^on the stack when the determining 
indicates that the function implements a thiscalhs^lling convention. 

2 1 . X^oqiputerized method for instrumenting an imported function in an executable file 
for testing by caUelMrfthe imported function, the method comprising: 

adding a wrapper oF^e^mported function to an import data block; 

adding a stub function for the imported function wherein the stub function comprises 
and instruction that saves the on^m^l function address to a threaded local 
storage variable and an instruction that c*ti*$es a jump to the user-supplied 
function; and \, 

adding an entry in a function lookup table of the original imporT^function. 

2. ^^Hie^omputerized method for instrumenting an imported function in an executable file 



determining if the prototype of the imported-fi^iction is correctly specified; and 
indicating an error when the determining indicates antoeorrectly specified prototype 
of the imported function. ^^s. 
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redirecting an emhedHftfi tnTrrtrmH^uJi ^wr ap]^ and 
adding an entry in a function lookup table of the address of the^mt 



action. 



24. 'A computerized method for instrumenting an embedded function in an executable file 
5 as in claim<23 5 wherein the redirecting is accomplished by an instruction that causes a jump to 
the user-supplied function. 
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25. A computerized Niethod for instrumenting an embedded function in an executable file 
as in claim 23, the method ttarther comprising: 

determining whether thesgrototype of the embedded function is correctly specified; 
and 

indicating an error when the deWmining whether the prototype of the embedded 

function is correctly specified indicates an incorrectly specified prototype of 
the embedded function. 



26. A computerized method for instrumenting an embedded function in an executable file 
as in claim 23 , wherein the function lookup table is in the^xecutable file. 



27. A computerized methoXfor^ublishing a function, the method comprising adding an 
20 entry describing the function in ajunction lookup table in a machine-readable executable file. 



computerizetrryatom conigrising: 

means for redirecting an original functTOTT-ift^aa^executable file to a user- 
supplied function; and 
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nfeans for retaining access information of the original function. 



A computerized system comprising: 

an executable file having a call to an original function, the original function 

having an identity comprising a name and a parameter prototype; and 
means for a user-supplied function that includes a call to the original function 
to retrieve stored access information of the original function. 




30. A computerized system comprising:^ 
10 an executable file having a jumjVto an original function, the original function 

having an identity comprising a name and a parameter prototype; 
a first software component having a user-supplied function that includes a 

jump to the original function; am 
a second software component for: 

1 5 receiving the identity of the original function; 

receiving the identity of the user-supplieil function; 

instrumenting the function in the executable^file using the identity of 
the user-supplied function; and 

storing the original function address in the execu\able file in association 
20 with the name of the original instrumented function. 



31. A computerized system comprising: 

a first module of machine-readable code comprising: 

a first instrumented function call to a first replacement function; and 
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a tirst^atastructure associating the identity of the first instrumented 

fimction^viththe location of the first instrumented function; and 
a second module comprising thenrstreplacement function, operatively 

coupled to the first module througJi^ajump to the first original function. 

^computerized system as in claim 31, 

wheft&yvthe first data structure comprises a function lookup table readily 

avait&bte for verifying that the threaded local storage variable contains 
the correct oftgmal instrumented function address; and 

wherein the second module coihprises a dynamic linked library. 



33. The computerized system as in claim 3 1 , further comprismg^ second data structure 
associating the location of the first data structure with the location of th^&st module. 



15 34. 



20 



The computerized system as in claim 31, further comprising: 
a third module bf machine-readable code comprising: 

a secondyistrumented function call to a second replacement function; 
and 

a second d^ ^ucturfe associating the identity of the second 
instrjjmenfed function with the location of the second 
instrumWed function; and 
a fourth module comprising the second replacement function, having a jump to 
the second originalXuriction. 



25 35. The computerized system as in claim 3 rv further comprising: 
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a third module W machine-readable code comprising: 

a secondVnstrumented function jump to a second replacement function; 
anc 

a secpnd dafci^tructure associating the identity of the second 
instrumented function with the location of the second 
instrumented function; and 
wherein the second module furtherVomprises the second replacement function, having 
a jump to the second original function. 

36. A^amguter-readable medium having computer-executable instructions to a cause a 
computer to perform aniethed^ompri sing: 

redirecting an original niiTctiQn in an executable file to a user-supplied 

function; and 
retaining access information of the original raiKjion. 

37. ^scomputer-readable medium having stored thereon a first data structure comprising a 
first module having a second data structure associating the identity of a first instrumented 
function with thelocation of the first instrumented function. 




having stored thereon a first module comprising a first 
of a first instrumented function with the location of the 



20 38. A computer-readal 
data structure associating tfie 
first instrumented function 



39. The computer-readable medium having stored thereon a first module as in claim 38, 
25 wherein the first data structure further comprises a 
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40. The computer-reaflarAe medium having stored thereon a data structure as in claim 38, 
wherein the first data structure njrther comprises a threaded local storage variable. 
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